Critical SSRF in SonicWall SMA 1000 Appliances (CVE‑2026‑102255) Enables Unauthenticated Internal Access
What It Is — A pre‑authentication Server‑Side Request Forgery (SSRF) flaw in the SonicWall SMA 1000 series (models 6210, 7210, 8200v) that allows an unauthenticated attacker to force the appliance to issue arbitrary internal requests. The vulnerability carries a CVSS 3.1 base score of 10.0.
Exploitability — Active exploitation has been observed in the wild by multiple threat‑intel firms within days of public disclosure; no vendor‑reported compromise yet, but attackers are already sending SSRF traffic to decoy appliances.
Affected Products — SonicWall SMA 1000 appliances running firmware 12.4.3‑03526 (or earlier) and 12.5.0‑02952 (or earlier). The flaw does not affect SSL‑VPN on SonicWall firewalls or the SMA 100 series.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous, automated monitoring of third‑party network devices to surface exploitation attempts in real time.
- Highlights the importance of maintaining auditable patch‑management evidence for critical infrastructure components.
- A single compromised appliance can bypass network segmentation, undermining the control objective of “Secure Configuration and Change Management” that maps to many compliance frameworks.
Recommended Actions
- Deploy the SonicWall hotfix immediately via the MySonicWall portal and verify firmware version post‑patch.
- Update your asset inventory to flag SMA 1000 devices and enforce a “patch‑within‑48‑hours” control, capturing evidence in your change‑management system.
- Enable outbound traffic monitoring on the appliance and ingest logs into a SIEM for SSRF‑specific alerts.
- Conduct a rapid risk assessment of any internal services reachable through the SMA appliance and isolate them if not required.
Source: Security Affairs